Item 03 / 04 · Permissions · LegalTech

Malakah Permissions

Who can see, ask and change a confidential contract.

An AI workspace adds a new kind of access: asking questions about a document. I designed Malakah’s permission system, from organisation roles down to a single contract, so legal teams can share without losing control.

Malakah Manage access window with a role picker showing Edit, Query and View

Packing slip

Role: Product Designer at Stixor, for Malakah. Access model, role picker, sharing flows and audit trail.
Duration: 2024 – 2026
Team: Legal teams, business approvers and org admins as users.
Status: Shipped
Work: 12 interviews6 contracts followed end to endArabic (RTL) + English (LTR)

4: access levels, one model
1,000+: legal professionals

01 · Problem

Every share was a copy nobody could take back.

Drafts went back and forth by email, finance approved in WhatsApp, and 9 of 12 people had sent an outdated version at least once.

Moving contracts into one workspace only helps if sharing inside it is as easy as forwarding an email, and much safer.

02 · Solution · Model

Four levels, each answering one question.

Rather than one long list of permissions, each level answers a single question, in the place where people ask it.

Organisation.Who is on our team? Admin or Member.
Project.Who works on this matter? Edit, Query or View.
Contract.Who can open this document? Per person, per file.
Signing.Who signs, in what order, until when? With an audit trail.

03 · Solution · Key decision

A role for asking, not editing.

Reading a 60-page supply agreement isn’t what a finance approver wants. With only Edit and View, they’d get edit rights they shouldn’t have, or no way to ask.

Query lets them run questions across a project’s files without changing anything.

Manage access window with a role picker showing Edit, Query and View — Each role is one sentence

04 · Solution · Sharing

Sharing that stays visible and reversible.

The access list sits inside the share window, so you never grant access without seeing who already has it.

One click to change.Revoking access happens where it was granted.
Pending is its own state.Invited people stay greyed out, and can be withdrawn before they get in.

Share this Contract window with an email field, role selector and access list — Share a contract

05 · Solution · Interface

The interface reflects your access.

Unavailable actions are removed, not disabled. A viewer never meets a button that fails, so the menu itself tells them what their access is.

Ownership is labelled with an Owner badge, plus separate “My projects” and “Shared with me” views.

Projects page with My Projects and Shared With Me tabs and Owner badges — Owners and shared projects

06 · Solution · Signing

Every signature leaves a record.

Signing involves people outside the company. Access for outside parties can expire, and the audit trail records every view and signature and exports as a certificate.

Signing table with statuses such as Pending, Completed and Expiring Soon — Five shared statuses

07 · Results & learnings

AI creates new kinds of access.

One permission model shipped across organisation, project, contract and signing, used by Malakah’s 1,000+ legal professionals.

Describe the action, not the role.A one-line “what you can do” beat any role name, especially across two languages.
Show access where it’s granted.It did more for safe sharing than a separate settings page would have.